企业网络下Superset登录重定向失败及CSRF令牌缺失问题求助

问题描述 #

访问Superset登录页后，页面被重定向至带next参数的登录地址（/login/?next=http://58.177.151.102:8088/superset/welcome/），登录操作触发CSRF令牌缺失错误，切换至非企业网络环境可正常运行。

错误日志 #

123.1.253.113 - - [26/Jun/2023:07:35:03 +0000] "GET /login/?next=http://58.177.151.102:8088/superset/welcome/ HTTP/1.1" 200 51415 "http://58.177.151.102:8088/superset/welcome/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.58"
2023-06-26 07:35:22,166:INFO:flask_wtf.csrf:The CSRF session token is missing.
Refresh CSRF token error
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/flask_wtf/csrf.py", line 261, in protect
    validate_csrf(self._get_csrf_token())
  File "/usr/local/lib/python3.9/site-packages/flask_wtf/csrf.py", line 103, in validate_csrf
    raise ValidationError("The CSRF session token is missing.")
wtforms.validators.ValidationError: The CSRF session token is missing.


During handling of the above exception, another exception occurred:


Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 1821, in full_dispatch_request
    rv = self.preprocess_request()
  File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 2313, in preprocess_request
    rv = self.ensure_sync(before_func)()
  File "/usr/local/lib/python3.9/site-packages/flask_wtf/csrf.py", line 229, in csrf_protect
    self.protect()
  File "/usr/local/lib/python3.9/site-packages/flask_wtf/csrf.py", line 264, in protect
    self._error_response(e.args[0])
  File "/usr/local/lib/python3.9/site-packages/flask_wtf/csrf.py", line 307, in _error_response
    raise CSRFError(reason)
flask_wtf.csrf.CSRFError: 400 Bad Request: The CSRF session token is missing.
2023-06-26 07:35:22,166:WARNING:superset.views.base:Refresh CSRF token error
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/flask_wtf/csrf.py", line 261, in protect
    validate_csrf(self._get_csrf_token())
  File "/usr/local/lib/python3.9/site-packages/flask_wtf/csrf.py", line 103, in validate_csrf
    raise ValidationError("The CSRF session token is missing.")
wtforms.validators.ValidationError: The CSRF session token is missing.


During handling of the above exception, another exception occurred:


Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 1821, in full_dispatch_request
    rv = self.preprocess_request()
  File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 2313, in preprocess_request
    rv = self.ensure_sync(before_func)()
  File "/usr/local/lib/python3.9/site-packages/flask_wtf/csrf.py", line 229, in csrf_protect
    self.protect()
  File "/usr/local/lib/python3.9/site-packages/flask_wtf/csrf.py", line 264, in protect
    self._error_response(e.args[0])
  File "/usr/local/lib/python3.9/site-packages/flask_wtf/csrf.py", line 307, in _error_response
    raise CSRFError(reason)
flask_wtf.csrf.CSRFError: 400 Bad Request: The CSRF session token is missing.

故障原因分析 #

1. 企业网络安全策略拦截Cookie：企业防火墙、代理或安全设备可能拦截了Superset设置的Session Cookie（存储CSRF令牌的载体），导致前端无法获取或传递CSRF令牌。
2. Superset URL配置不匹配：next参数中出现完整URL，说明Superset的SERVER_NAME或PREFERRED_URL_SCHEME配置与实际访问地址不一致，引发会话上下文不匹配。
3. 反向代理头传递异常：若企业网络使用反向代理，未正确传递X-Forwarded-Proto、X-Forwarded-Host等头信息，会导致Flask无法识别真实请求地址，进而Session/Cookie失效。

解决方案 #

• 检查网络安全策略：联系企业IT团队，确认是否有规则拦截了目标IP的Cookie，允许该地址的session、csrf_token相关Cookie正常传递。
• 修正Superset配置：在Docker环境中，通过环境变量调整Superset配置：

  # 设置SERVER_NAME为实际访问的IP+端口
  -e SUPERSET_SERVER_NAME=58.177.151.102:8088
  # 设置请求协议
  -e SUPERSET_PREFERRED_URL_SCHEME=http
  # 若使用反向代理，开启代理修复
  -e SUPERSET_ENABLE_PROXY_FIX=True
  

• 清理浏览器缓存：在企业网络环境下，清空浏览器的Cookie和缓存后重新访问登录页，避免旧会话干扰。
• 排查请求头与Cookie：打开浏览器开发者工具（F12），切换至Network标签，查看登录请求的Request Headers中是否包含Cookie字段，且字段内有csrf_token相关内容，确认Cookie是否被拦截。

内容的提问来源于stack exchange，提问作者Boogaloo Li